"If you don't want to be vulnerable just install this vibecode project from a 10 minute old repo someone posted."
Doesn't really feel like it's a good way to handle security to me.
Doesn't really feel like it's a good way to handle security to me.
This is MIT open source, run it through your own LLM. If you find a bug, submit a fix.
If you're paranoid, launch it as a Linux user with no access to any files. It's just supposed to proxy some network requests.
I'm sure you have the best intentions. I still think anyone trying to fix a massive security hole by running random 10 minute old code from Github isn't really being smart about it.
Shut down the affected services until they can install the patch. This issue is widespread enough that users will understand. Many government etc sites are affected too.